A database containing medical records of almost 200,000 U.S. military veterans was recently discovered to have been exposed online by a vendor contracted by the Veterans Administration, according to a May 11 Threat Post report.
A researcher found the files exposed online April 18; the records made several references to United Valor Solutions, a disability evaluation services provider for the VA and other federal and state agencies, the publication reports.
"It appears that a researcher was attempting to find security deficiencies and flaws in United Valor Solutions systems. At this time, we do not believe there was a data breach but rather this was done for research purposes, at the request of the contractor, United Valor Solutions," A VA spokesperson said in a May 12 emailed statement to Becker's Hospital Review.
The Veterans Benefits Administration Privacy Office and the Medical Disability Examination Officer are working with contractors to investigate the incident, the spokesperson said. The VA Data Breach Response Service is also investigating the incident independently.
The exposed data included patient names, birth dates, medical information, contact information and physician details. The database also exposed unencrypted passwords and billing information.
"The database was set to open and visible in any browser (publicly accessible) and anyone could edit, download or even delete data without administrative credentials," the researcher told Threat Post.